EUVD-2026-69193

Incorrect access control in the setDevReboot function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reboot the local device and, on a master, fan out reboot commands to mesh slaves via sending a crafted MQTT message to the csbroker component...

EUVD-2026-69204

Incorrect access control in the delSlaveDevice function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove a specified slave device from local mesh management data and reboot the system via sending a crafted MQTT message to the csbroker component...

EUVD-2026-69202

Incorrect access control in the updateSlaveIpList function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to overwrite the slave IP inventory state via sending a crafted MQTT message to the csbroker component...

EUVD-2026-69200

Incorrect access control in the meshSlaveUpdate function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to start a firmware download or flash workflow on the slave device via sending a crafted MQTT message to the csbroker component...

EUVD-2026-69197

Incorrect access control in the meshInfoKick function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to kick or clean stale mesh information/state and trigger regeneration of mesh metadata via sending a crafted MQTT message to the csbroker component...

EUVD-2026-69203

Incorrect access control in the staticInfoSend function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to trigger static information reporting to the configured master via sending a crafted MQTT message to the csbroker component...

EUVD-2026-69206

Incorrect access control in the sendStaticInfoToMaster function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to update stored slave inventory records via sending a crafted MQTT message to the csbroker component...

EUVD-2026-69205

Incorrect access control in the updatePriChannel function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to rescan and switch the primary mesh channel via sending a crafted MQTT message to the csbroker component...

EUVD-2026-69201

Incorrect access control in the meshSlaveUpgfw function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to start firmware flashing using existing upgrade files via sending a crafted MQTT message to the csbroker component...

EUVD-2026-69199

Incorrect access control in the informSyncUpgfw function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to mass-trigger firmware update activity across mesh slaves via sending a crafted MQTT message to the csbroker component...

EUVD-2026-69196

Incorrect access control in the freeStaClient function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to forcibly disconnect wireless clients via sending a crafted MQTT message to the csbroker component...

EUVD-2026-69198

Incorrect access control in the updateLanIp function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to refresh the LAN address state via sending a crafted MQTT message to the csbroker component...

EUVD-2026-69195

Incorrect access control in the recvSlaveCloudCheckStatus function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to overwrite cloud-result tracking files via sending a crafted MQTT message to the csbroker component...

EUVD-2026-69194

Incorrect access control in the recvIndirectMeshInfo function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to insert or replace mesh neighbor records via sending a crafted MQTT message to the csbroker component...

EUVD-2026-69208

Incorrect access control in the updatePriStaList function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to refresh the primary station list via sending a crafted MQTT message to the csbroker component...

EUVD-2026-69210

Incorrect access control in the guestwifisync function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to disable guest virtual AP interfaces via sending a crafted MQTT message to the csbroker component...

EUVD-2026-69209

Incorrect access control in the recvmeshinfosync function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to force mesh configuration synchronization from an attacker-controlled host via sending a crafted MQTT message to the csbroker component...

CVE-2026-51766

Incorrect access control in the setDevReboot function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to reboot the local device and, on a master, fan out reboot commands to mesh slaves via sending a crafted MQTT message to the csbroker component...

CVE-2026-51761

Incorrect access control in the updateLanIp function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to refresh the LAN address state via sending a crafted MQTT message to the csbroker component...

CVE-2026-51752

Incorrect access control in the staticInfoSend function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to trigger static information reporting to the configured master via sending a crafted MQTT message to the csbroker component...